Move hardware configs.

fs0.nix

@@ -3,17 +3,20 @@ let
   pki = pkgs.callPackage ./lib/pki.nix {};
   certs = {
     ca = pki.ca;
-    fs = pki.etcd ''
+    fs0 = pki.trust "fs0" ''
         "fs0-0",
         "fs0-1",
+        "fs0-2",
         "10.253.18.106",
         "10.1.2.164",
+        "10.253.18.100",
         "127.0.0.1"
       '';
   };
   clusterHosts = ''
     10.253.18.106 fs0-0
     10.1.2.164    fs0-1
+    10.253.18.100 fs0-2
   '';
 
   nixosConfig = node: {
@@ -21,18 +24,20 @@ let
     networking = {
       hostName = node;
       extraHosts = clusterHosts;
-      # firewall.allowedTCPPortRanges = [ { from = 5000; to = 50000; } ];
-      # firewall.allowedTCPPorts = [ 80 443 ];
     };
-    environment.systemPackages = [ pkgs.tshark ];
     services.glusterfs = {
       enable = true;
       tlsSettings = {
         caCert = certs.ca.cert;
-        tlsKeyPath = certs.fs.key;
-        tlsPem = certs.fs.cert;
+        tlsKeyPath = certs.fs0.key;
+        tlsPem = certs.fs0.cert;
       };
     };
+    networking.firewall.extraCommands = ''
+        iptables -I INPUT -p all -s 10.253.18.100 -j ACCEPT
+        iptables -I INPUT -p all -s 10.253.18.106 -j ACCEPT
+        iptables -I INPUT -p all -s 10.1.2.164 -j ACCEPT
+    '';
   };
 in
 {
@@ -46,7 +51,7 @@ in
       services.nfs.server = {
         enable=true;
         exports= ''
-          /data/vol1 10.253.18.0/24(insecure,rw,sync,no_subtree_check,crossmnt,fsid=0,no_root_squash)
+          /data/nfs0 10.253.18.0/24(insecure,rw,sync,no_subtree_check,crossmnt,fsid=0,no_root_squash)
         '';
       };
       networking.firewall.allowedTCPPorts = [ 111 2049 ];